Summary
- AgentForger could create and publish an attacker-directed workspace agent after an authenticated user opened a crafted link.
- Existing Outlook, Gmail, Slack, Drive, SharePoint, or Teams permissions could be inherited without new OAuth consent.
- Agent inventories and approval controls need to cover creation, connectors, publication, and scheduled execution.
A patched weakness in OpenAI’s ChatGPT Workspace Agents could allow an attacker to create and publish an autonomous agent inside an organisation after an authenticated user opened a crafted link.
The research, named AgentForger by Zenity, used parameters accepted by the Workspace Agents builder to preload an attacker-controlled prompt. When the victim followed the URL while logged into ChatGPT, the interface automatically submitted the instructions and began creating an agent without requiring direct compromise of the user’s password or session.
Exploitation depended on several conditions. The user needed access to Workspace Agents and at least one enterprise connector that had already been authorised, such as Outlook, Gmail, Slack, Google Drive, SharePoint, or Microsoft Teams. The malicious agent could then attach those existing connectors and inherit the permissions delegated to the victim.
Zenity’s proof of concept also changed connector approvals to “Never ask”, published the agent, and established recurring tasks. An attacker-controlled email address then acted as a command channel, allowing new instructions to be delivered through scheduled runs.
The vulnerability was reported to OpenAI on 4 June and fixed on 8 June. No evidence of exploitation against production organisations has been disclosed. Zenity’s first technical analysis describes the creation path, while a second report demonstrates the actions available after the agent had been published.
The weakness resembles cross-site request forgery, although the resulting object carries more authority than a conventional unwanted setting change. A forged agent can persist after the original browser interaction, operate on a schedule, and use delegated access across several business systems.
OAuth consent is usually granted to a legitimate platform for a legitimate purpose, but the resulting permission can be reused by agents created later within the same environment. The absence of a new consent screen does not mean that no new access decision has occurred.
Enterprise agents introduce another layer of non-human identity. Each one can have an owner, instructions, connected systems, approval policy, publication state, and schedule. Those attributes need to be recorded and governed alongside service accounts, automation identities, and integrations.
A user who can create an agent should not necessarily be able to disable approval prompts, attach every available connector, publish the result, and establish recurring execution without independent review. Separating those capabilities limits the authority created by one compromised account or browser interaction.
Monitoring also needs to extend beyond user login events. Organisations need records showing who created an agent, which configuration was used, which connectors were attached, when approval settings changed, what schedules were established, and which data or external actions followed.
An inventory containing only human users will not identify the object performing the later activity. Agent ownership, privilege, and status need to remain visible after publication, particularly where the agent can continue to run without the originating user returning to the platform.
The specific creation weakness has been fixed, and the research does not show widespread exploitation. Delegated permissions, natural-language configuration, publication, and recurring execution remain common features of enterprise agent platforms, carrying authority that can be difficult to reconstruct from any single control plane.
As agents move into business workflows, organisations need a clear boundary between ordinary creation and privileged administration. The prompt defines behaviour, while identity policy, connector scope, and execution approval determine what the agent can reach.
